hereya-cli 0.100.5 → 0.101.0

package/dist/iac/terraform.js

@@ -4,7 +4,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { pipeline } from 'node:stream/promises';
 import { Extract as decompress } from 'unzip-stream';
-import { mapObject } from '../lib/object-utils.js';
+import { mapObject, paramToEnvString } from '../lib/object-utils.js';
 import { runShell } from '../lib/shell.js';
 export class Terraform {
     async apply(input) {
@@ -46,12 +46,12 @@ export class Terraform {
                 env: {
                     ...mapObject(input.env ?? {}, (key, value) => [
                         `TF_VAR_${key}`,
-                        typeof value === 'object' ? JSON.stringify(value) : value,
+                        paramToEnvString(value),
                     ]),
                     ...input.env,
                     ...mapObject(input.parameters ?? {}, (key, value) => [
                         `TF_VAR_${key}`,
-                        typeof value === 'object' ? JSON.stringify(value) : value,
+                        paramToEnvString(value),
                     ]),
                 },
                 logger: input.logger,
@@ -61,12 +61,12 @@ export class Terraform {
                 env: {
                     ...mapObject(input.env ?? {}, (key, value) => [
                         `TF_VAR_${key}`,
-                        typeof value === 'object' ? JSON.stringify(value) : value,
+                        paramToEnvString(value),
                     ]),
                     ...input.env,
                     ...mapObject(input.parameters ?? {}, (key, value) => [
                         `TF_VAR_${key}`,
-                        typeof value === 'object' ? JSON.stringify(value) : value,
+                        paramToEnvString(value),
                     ]),
                 },
                 logger: input.logger,
@@ -124,12 +124,12 @@ export class Terraform {
                 env: {
                     ...mapObject(input.env ?? {}, (key, value) => [
                         `TF_VAR_${key}`,
-                        typeof value === 'object' ? JSON.stringify(value) : value,
+                        paramToEnvString(value),
                     ]),
                     ...input.env,
                     ...mapObject(input.parameters ?? {}, (key, value) => [
                         `TF_VAR_${key}`,
-                        typeof value === 'object' ? JSON.stringify(value) : value,
+                        paramToEnvString(value),
                     ]),
                 },
                 logger: input.logger,
@@ -140,12 +140,12 @@ export class Terraform {
                 env: {
                     ...mapObject(input.env ?? {}, (key, value) => [
                         `TF_VAR_${key}`,
-                        typeof value === 'object' ? JSON.stringify(value) : value,
+                        paramToEnvString(value),
                     ]),
                     ...input.env,
                     ...mapObject(input.parameters ?? {}, (key, value) => [
                         `TF_VAR_${key}`,
-                        typeof value === 'object' ? JSON.stringify(value) : value,
+                        paramToEnvString(value),
                     ]),
                 },
                 logger: input.logger,

package/dist/lib/app-source.d.ts

@@ -1,5 +1,18 @@
 import { Logger } from './log.js';
 export interface DownloadAppSourceInput {
+    /**
+     * Optional git credentials resolved via the hereya GitHub-App credential
+     * mechanism. When `password` (and optionally `username`) are provided, the
+     * clone is performed through the hereya credential helper so PRIVATE app
+     * repositories can be cloned on a headless executor. When omitted, an
+     * unauthenticated clone is performed (public-repo path preserved).
+     */
+    auth?: {
+        /** Absolute path to the hereya binary used as the credential helper. */
+        hereyaBinPath: string;
+        password?: string;
+        username?: string;
+    };
     commit?: string;
     logger?: Logger;
     repository: string;
@@ -9,6 +22,17 @@ export interface DownloadAppSourceOutput {
     cleanup: () => Promise<void>;
     rootDir: string;
 }
+/**
+ * Minimal surface of `simple-git` used by this module. Kept narrow so tests can
+ * supply a lightweight fake.
+ */
+export interface SimpleGitLike {
+    checkout(commit: string): Promise<unknown>;
+    clone(repo: string, target: string, options?: string[]): Promise<unknown>;
+    raw(args: string[]): Promise<Buffer | string>;
+}
+export type SimpleGitFactory = (baseDir?: string) => SimpleGitLike;
+export declare function setSimpleGitFactory(factory: SimpleGitFactory | undefined): void;
 /**
  * Clone an app's source repository (by repo URL + commit SHA) into a fresh
  * temp dir under ~/.hereya/downloads/<id>. Returns the rootDir path along

package/dist/lib/app-source.js

@@ -2,6 +2,19 @@ import { createHash, randomUUID } from 'node:crypto';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import { gitUtils } from './git-utils.js';
+// DI seam for tests. Defaults to the real `simple-git` (loaded lazily so the
+// module stays cheap to import). Tests replace this via `setSimpleGitFactory`.
+let simpleGitFactory;
+export function setSimpleGitFactory(factory) {
+    simpleGitFactory = factory;
+}
+async function getSimpleGit() {
+    if (simpleGitFactory)
+        return simpleGitFactory;
+    const { simpleGit } = await import('simple-git');
+    return simpleGit;
+}
 /**
  * Clone an app's source repository (by repo URL + commit SHA) into a fresh
  * temp dir under ~/.hereya/downloads/<id>. Returns the rootDir path along
@@ -24,16 +37,40 @@ export const appSource = {
             }
         };
         try {
-            const { simpleGit } = await import('simple-git');
-            const git = simpleGit();
+            const simpleGit = await getSimpleGit();
             input.logger?.debug?.(`Cloning app source from ${input.repository}${input.commit ? `@${input.commit}` : ''} into ${rootDir}`);
-            if (input.commit) {
-                await git.clone(input.repository, rootDir, ['--no-checkout']);
-                const repoGit = simpleGit(rootDir);
-                await repoGit.checkout(input.commit);
+            if (input.auth?.password) {
+                // Authenticated clone through the hereya credential helper. We always
+                // do a full clone here (no shallow/no-checkout optimization) because
+                // the credential helper path uses a plain `git clone`; the optional
+                // commit checkout is performed afterwards.
+                input.logger?.debug?.('Using hereya credential helper for authenticated app-source clone');
+                const cloneResult = await gitUtils.cloneWithCredentialHelper({
+                    gitUrl: input.repository,
+                    hereyaBinPath: input.auth.hereyaBinPath,
+                    password: input.auth.password,
+                    targetDir: rootDir,
+                    username: input.auth.username,
+                });
+                if (!cloneResult.success) {
+                    throw new Error(cloneResult.reason);
+                }
+                if (input.commit) {
+                    const repoGit = simpleGit(rootDir);
+                    await repoGit.checkout(input.commit);
+                }
             }
             else {
-                await git.clone(input.repository, rootDir, ['--depth=1']);
+                // Unauthenticated clone (public-repo path).
+                const git = simpleGit();
+                if (input.commit) {
+                    await git.clone(input.repository, rootDir, ['--no-checkout']);
+                    const repoGit = simpleGit(rootDir);
+                    await repoGit.checkout(input.commit);
+                }
+                else {
+                    await git.clone(input.repository, rootDir, ['--depth=1']);
+                }
             }
             if (input.sha256) {
                 const repoGit = simpleGit(rootDir);

package/dist/lib/executor-start/execute-app-job.d.ts

@@ -1,4 +1,5 @@
 import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
+import { LocalExecutor } from '../../executor/local.js';
 import { Logger } from '../../lib/log.js';
 export type AppJobResult = {
     reason: string;
@@ -10,4 +11,4 @@ export declare function executeAppJob(job: {
     id: string;
     payload: any;
     type: string;
-}, cloudBackend: CloudBackend, logger: Logger): Promise<AppJobResult>;
+}, cloudBackend: CloudBackend, logger: Logger, executor: LocalExecutor): Promise<AppJobResult>;

package/dist/lib/executor-start/execute-app-job.js

@@ -3,7 +3,7 @@ import path from 'node:path';
 import * as appSourceLib from '../../lib/app-source.js';
 import { shellUtils } from '../../lib/shell.js';
 import { sanitizeWorkspaceForFilename } from './format.js';
-export async function executeAppJob(job, cloudBackend, logger) {
+export async function executeAppJob(job, cloudBackend, logger, executor) {
     const isDeploy = job.type === 'app-deploy';
     const subcommand = isDeploy ? 'deploy' : 'destroy';
     const payload = job.payload;
@@ -17,7 +17,8 @@ export async function executeAppJob(job, cloudBackend, logger) {
     let cleanup;
     try {
         logger.info(`Downloading app source ${repository}${commit ? `@${commit}` : ''}...`);
-        const downloadResult = await appSourceLib.appSource.download({ commit, logger, repository, sha256 });
+        const auth = await resolveAppRepoCredentials({ appName, executor, logger, repository, workspace });
+        const downloadResult = await appSourceLib.appSource.download({ auth, commit, logger, repository, sha256 });
         cleanup = downloadResult.cleanup;
         const { rootDir } = downloadResult;
         await cloudBackend.updateAppDeployment({
@@ -74,6 +75,58 @@ export async function executeAppJob(job, cloudBackend, logger) {
         }
     }
 }
+/**
+ * Resolve git credentials for cloning the app's source repository, reusing the
+ * SAME hereya GitHub-App credential mechanism used for package/project clones.
+ *
+ * We build a synthetic git env map (`hereyaGitRemoteUrl` + a `github-app:`
+ * marker for the password) and run it through `executor.resolveEnvValues`,
+ * which:
+ *   1. reads the GitHub-App config (`hereyaGithubAppId`,
+ *      `hereyaGithubAppPrivateKey`, optional `hereyaGithubAppInstallationId`)
+ *      from the workspace env, and
+ *   2. mints an installation token scoped to the repo named by
+ *      `hereyaGitRemoteUrl`.
+ *
+ * If the GitHub-App config is not available (token not minted, marker left
+ * unresolved), we return `undefined` so the caller falls back to an
+ * unauthenticated clone (public-repo path preserved).
+ */
+async function resolveAppRepoCredentials(input) {
+    const { appName, executor, logger, repository, workspace } = input;
+    try {
+        const gitEnvToResolve = {
+            // Empty installation id => resolveGithubAppMarkers falls back to
+            // hereyaGithubAppInstallationId from the workspace env.
+            hereyaGitPassword: 'github-app:',
+            // Peer URL used to scope the minted installation token to this repo.
+            hereyaGitRemoteUrl: repository,
+            hereyaGitUsername: 'x-access-token',
+        };
+        // For apps, workspace env is keyed by the app name (see LocalExecutor.getWorkspaceEnv).
+        const resolved = await executor.resolveEnvValues({
+            env: gitEnvToResolve,
+            project: appName,
+            workspace,
+        });
+        const password = resolved.hereyaGitPassword;
+        // If the marker was left unresolved (no GitHub-App config available), the
+        // value still starts with `github-app:` — treat that as "no auth".
+        if (!password || password.startsWith('github-app:')) {
+            logger.debug?.('No hereya GitHub-App credentials resolved for app source; falling back to unauthenticated clone');
+            return undefined;
+        }
+        return {
+            hereyaBinPath: process.argv[1],
+            password,
+            username: resolved.hereyaGitUsername || 'x-access-token',
+        };
+    }
+    catch (error) {
+        logger.debug?.(`Failed to resolve hereya GitHub-App credentials for app source (${error?.message ?? error}); falling back to unauthenticated clone`);
+        return undefined;
+    }
+}
 async function runAppSubcommand(input) {
     const { appName, logger, paramFlags, rootDir, subcommand, versionFlags, workspace } = input;
     let runResult;

package/dist/lib/executor-start/job-dispatch.js

@@ -90,7 +90,7 @@ export async function dispatchJob(job, executor, cloudBackend, hooks) {
             return;
         }
         if (job.type === 'app-deploy' || job.type === 'app-destroy') {
-            const appJobResult = await executeAppJob(job, cloudBackend, logger);
+            const appJobResult = await executeAppJob(job, cloudBackend, logger, executor);
             await finalize(appJobResult, job.type);
             return;
         }

package/dist/lib/object-utils.d.ts

@@ -1,4 +1,24 @@
 export declare function mapObject(obj: object, fn: (key: string, value: any) => [string, any]): object;
+/**
+ * Coerce a parameter value (as parsed from a hereyavars YAML file or
+ * forwarded through the executor) into the string form expected by the
+ * package's CDK/Terraform process when injected as an environment variable
+ * or CLI argument.
+ *
+ * - Strings (including pre-stringified JSON) pass through unchanged so the
+ *   existing "stringify it yourself" workaround keeps working.
+ * - Numbers and booleans become their plain string representation
+ *   (matching the previous behavior of `String(value)`).
+ * - Arrays and objects are JSON-encoded so the receiving package can
+ *   `JSON.parse(process.env.foo)` instead of receiving "[object Object]"
+ *   or a comma-joined `Array.prototype.toString()`.
+ * - `null` and `undefined` become an empty string.
+ *
+ * Intended to be applied at the single boundary where the env map for the
+ * package process is built — not earlier in the pipeline, so the parsed
+ * YAML can stay structured everywhere else in the CLI.
+ */
+export declare function paramToEnvString(value: unknown): string;
 export declare function arrayOfStringToObject(arr: string[], keyValueSeparator?: string): {
     [k: string]: string;
 };

package/dist/lib/object-utils.js

@@ -1,6 +1,36 @@
 export function mapObject(obj, fn) {
     return Object.fromEntries(Object.entries(obj).map(([key, value]) => fn(key, value)));
 }
+/**
+ * Coerce a parameter value (as parsed from a hereyavars YAML file or
+ * forwarded through the executor) into the string form expected by the
+ * package's CDK/Terraform process when injected as an environment variable
+ * or CLI argument.
+ *
+ * - Strings (including pre-stringified JSON) pass through unchanged so the
+ *   existing "stringify it yourself" workaround keeps working.
+ * - Numbers and booleans become their plain string representation
+ *   (matching the previous behavior of `String(value)`).
+ * - Arrays and objects are JSON-encoded so the receiving package can
+ *   `JSON.parse(process.env.foo)` instead of receiving "[object Object]"
+ *   or a comma-joined `Array.prototype.toString()`.
+ * - `null` and `undefined` become an empty string.
+ *
+ * Intended to be applied at the single boundary where the env map for the
+ * package process is built — not earlier in the pipeline, so the parsed
+ * YAML can stay structured everywhere else in the CLI.
+ */
+export function paramToEnvString(value) {
+    if (value === null || value === undefined)
+        return '';
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'number' || typeof value === 'boolean') {
+        return String(value);
+    }
+    // Objects/arrays -> JSON. Round-trippable and what package authors expect.
+    return JSON.stringify(value);
+}
 export function arrayOfStringToObject(arr, keyValueSeparator = '=') {
     return Object.fromEntries(arr.map((item) => {
         const [key, value] = item.split(keyValueSeparator);